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The  Department  of  State  is  spending  hundreds  of  millions  of  dollars  to 
replace  its  antiquated  information  technology  (it)  infrastructure  with 
modem  hardware  and  software  systems.  In  January  1997,  the  Department 
of  State  issued  its  5-year,  $2. 7-billion  information  resource  management 
(irm)  strategic  plan  which  is  designed  to  achieve  a  number  of  key  goals  by 
the  end  of  fiscal  year  2001,  including  (1)  installing  Year  2000  compliant 
hardware  and  software  systems  throughout  State,  (2)  upgrading  State’s  rr 
infrastructure,  and  (3)  instituting  professional  management  principles  in 
all  facets  of  State’s  it  operations.  State’s  strategic  plan  is  accompanied  by 
a  tactical  plan  that  describes  the  65  modernization  projects  designed  to 
achieve  the  Department’s  strategic  plan  objectives. 

In  light  of  disappointing  results  from  prior  State  modernization  efforts  and 
widely  publicized  accounts  of  failed  and  costly  modernization  programs  at 
several  other  federal  agencies,  you  asked  us  to  examine  the  soundness  of 
State’s  approach  to  modernizing  its  rr  infrastructure.  This  report  provides 
information  and  analysis  on  the  progress  made  by  State  in  implementing 
key  rr  management  oversight  and  investment  planning  requirements 
mandated  in  recent  federal  legislation  and  related  Office  of  Management 
and  Budget  (omb)  guidance.  We  also  examined  the  soundness  of  the  5-year 
cost  estimate  included  in  the  Department’s  irm  strategic  plan  and  whether 
this  estimate  incorporates  potential  cost  savings  and  efficiencies  from 
State’s  modernization  efforts. 


Background 


The  Department  faces  the  difficult  and  challenging  task  of  replacing  its 
classified  and  unclassified  systems  with  hardware  and  software  systems 
that  are  Year  2000  compliant  and  fully  satisfy  the  Department’s 
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information  resource  needs.1  With  an  it  workforce  of  over  3,400 
individuals,  State  manages  a  complex  mix  of  approximately  260  discrete 
information  systems  designed  to  support  a  broad  range  of  diplomatic  and 
administrative  functions.  The  Department  relies  on  these  systems  for 
much  of  its  operations  including  diplomatic  messaging,  visa  and  passport 
processing,  and  administrative  functions  such  as  financial,  personnel,  and 
logistics  management.  In  fiscal  year  1998,  State  has  budgeted  $573  million 
to  conduct  its  rr  operations,  of  which  $293  million  is  budgeted  for  its 
modernization  efforts.  Key  modernization  projects  include  upgrading  the 
unclassified  it  infrastructure  at  posts  worldwide,  instituting  a  series  of 
messaging  system  improvements,  modernizing  the  Department’s  financial 
management  systems,  and  launching  a  number  of  it  management 
improvements  in  such  areas  as  it  architecture  planning,  project  planning 
and  management,  human  resource  planning,  and  irm  training. 

State  has  recognized  for  years  that  its  it  hardware  and  software  platforms 
are  aging  and  inefficient,  making  it  difficult  to  conduct  business  in  today’s 
information-driven  society.  Beginning  in  the  early  1990s,  State  has 
experienced  difficulties  in  achieving  its  short  and  long-term  modernization 
goals.  For  example,  in  August  1994,  we  reported  that  State’s  attempt  to 
modernize  its  financial  management  systems  was  subject  to  a  high  risk  of 
failure  because  the  Department’s  management  and  planning  for  this  effort 
had  been  inadequate.2  Subsequently,  in  1995,  State  ended  this  effort  and 
adopted  a  revised  approach  to  modernizing  its  domestic  and  overseas 
financial  systems.  In  December  1994,  we  reported  that  State  had  placed 
several  major  modernization  efforts  at  risk  by  not  following  a  number  of 
irm  management  best  practices,  including  the  need  to  develop  an 
integrated  information  technology  architecture  to  help  guide  the 
Department’s  investment  decisions.3  In  July  1995,  State  issued  a  report  on 
its  modernization  efforts  that  noted  that  accelerating  the  pace  of 


dn  January  1, 2000,  computer  systems  that  are  not  Year  2000  compliant  will  malfunction  or  produce 
inaccurate  information  because  the  year  2000  will  be  indistinguishable  from  the  year  1900.  This 
problem  is  rooted  in  the  fact  that  many  computer  systems  use  only  two  digits  to  designate  the  year.  We 
recently  reported  on  State’s  progress  in  addressing  Year  2000  issues.  See  Year  2000  Computing  Crisis: 
State  Department  Needs  to  Make  Fundamental  Improvements  to  Its  Year  2000  Program 
(GAO/AIMD-98-162,  Aug.  28, 1998). 

2Financial  Management:  State’s  Systems  Planning  Needs  to  Focus  on  Correcting  Long-standing 
Problems  (GAO/NS1AD-94-141,  Aug.  12, 1994). 

department  of  State:  Strategic  Approach  Needed  to  Better  Support  Agency  Mission  and  Business 
Needs  (GAO/AIMD-95-20,  Dec.  22, 1994). 
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implementation  would  require  that  systematic  changes  be  made  to  the 
Department’s  it  management  practices.4 

The  1995  Paperwork  Reduction  Act,6  the  1996  Clinger-Cohen  Act,6  and 
related  omb  guidance  lay  out  a  number  of  required  best  practices  designed 
to  help  federal  agencies  better  manage  their  it  resources.  The  Paperwork 
Reduction  Act  is  the  “umbrella”  it  legislation  for  the  federal  government, 
while  the  Clinger-Cohen  Act  requires  that  federal  agencies  establish  a 
disciplined  approach  to  managing  it  resources.  This  legislation  and 
guidance  requires  that  the  head  of  each  executive  agency  design  and 
implement  a  process  for  maximizing  the  value,  and  assessing  and 
managing  the  risks,  of  it  acquisitions.  Key  actions  called  for  include 
appointing  a  Chief  Information  Officer,  preparing  an  irm  strategic  plan, 
establishing  a  rigorous  planning  and  investment  process,  and  developing 
an  integrated  information  architecture  to  ensure  that  agency  resources  are 
utilized  in  the  most  effective  manner  possible.  These  and  other  it 
management  requirements  are  summarized  in  omb’s  July  1997  capital 
programming  guide  and  our  February  1997  it  investment  guide.7 

Consistent  with  federal  legislation  and  omb  guidance,  State  appointed  a 
Chief  Information  Officer,  prepared  an  irm  strategic  plan  and  related 
tactical  plans,  and  developed  a  conceptual  it  planning  and  investment 
framework  consisting  of  three  irm  oversight  boards  to  manage  its  it 
planning  and  investment  process.  The  conceptual  framework  called  for  an 
irm  Program  Board  to  review  project  proposals  and  periodically  assess  the 
implementation  status  of  ongoing  projects,  an  irm  Technical  Review  Board 
to  ensure  that  it  projects  are  technically  sound  and  that  adequate 
architectural  and  budget  planning  takes  place,  and  an  irm  Configuration 
Control  Board  to  ensure  that  existing  and  planned  systems  will  effectively 
operate  together. 

State’s  conceptual  framework  requires  that  all  three  governing  boards 
coordinate  their  activities  to  achieve  the  goals  of  the  it  planning  and 
investment  process.  These  goals  include  (1)  ensuring  that  irm  decisions 


Accelerating  Modernization  at  the  Department  of  State:  A  Report  of  the  Strategic  Management 
Initiative  Information  Technology  Team  (Office  of  the  Chief  Information  Officer,  U.S.  Department  of 
State,  July  17,  1995). 

6Public  Law  104-13, 109  Stat.  163. 

6Public  Law  104-106, 110  Stat.  679. 

7Capital  Programming  Guide  (Washington,  D.C.:  OMB,  July  1997)  and  Assessing  Risks  and  Returns:  A 
Guide  for  Evaluating  Federal  Agencies’  IT  Investment  Decision-Making  (GAO/AIMD-10.1.13, 

Feb.  1997). 
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are  integrated  with  the  organization’s  structure  and  budget,  (2)  assessing 
the  knowledge  and  skills  of  the  Department’s  it  workforce  relative  to 
perceived  requirements,  (3)  establishing  performance  measures, 

(4)  analyzing  mission  and  related  business  processes,  (5)  evaluating 
investments,  and  (6)  measuring  progress  against  established 
implementation  goals.  Key  anticipated  “outputs”  from  State’s  conceptual 
framework  include  an  information  technology  architecture,  a  strategic 
plan,  a  tactical  plan  listing  approved  projects,  a  human  resource  plan  for  it 
workers,  and  long-term  funding  estimates  developed  through  the  use  of  a 
“cost  model.”  Figure  1  illustrates  the  component  parts  of  State’s 
conceptual  framework. 


Figure  1 :  State’s  IT  Planning  and  Investment  Framework 
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Results  in  Brief 


State  has  developed  an  information  technology  planning  and  investment 
framework  for  managing  its  it  resources  that  is  consistent  with  the  intent 
of  applicable  federal  guidance.  However,  full  implementation  of  the 
framework  does  not  appear  to  be  a  top  management  priority.  Without  a 
fully  functioning  framework,  State  cannot  be  assured  that  it  is  making  the 
most  cost-effective  decisions  as  it  modernizes  its  information  technology 
operations,  that  systems  will  perform  as  expected,  or  that  its  information 
technology  cost  estimates  are  sound.  As  a  result,  there  is  substantial  risk 
that  State’s  modernization  program  will  not  achieve  desired  results,  will 
cost  more  than  anticipated,  and  will  take  longer  to  put  in  place. 

State’s  oversight  mechanisms  are  not  fully  functioning  as  envisioned  in  its 
conceptual  framework.  While  an  irm  Program  Board  has  been  established, 
it  has  not  yet  adopted  the  more  disciplined  project  management  processes 
called  for  by  the  Clinger-Cohen  Act  and  related  omb  guidance.  The  irm 
Technical  Review  Board  and  irm  Configuration  Control  Board  remain  to  be 
fully  established.  State  also  does  not  yet  have  an  agency-approved 
information  technology  architecture  to  help  guide  the  Department’s 
investment  decisions.  The  Department  has  not  established  a  specific 
action  plan  or  related  timetable  to  implement  these  remaining  components 
of  the  framework.  Department  officials  attributed  delays  in  implementing 
this  framework  to  a  number  of  factors,  including  senior  management 
turnover,  internal  reorganization,  competing  priorities  such  as  the  Year 
2000  and  computer  security  issues,  staffing  shortages,  and  the  absence  of 
an  agreed  upon  vision  regarding  the  Department’s  technical  direction  and 
operational  requirements. 

State’s  5-year  cost  estimate,  prepared  in  October  1996  and  referenced  in 
State’s  strategic  plan  submitted  to  the  Congress,  is  speculative.  First,  the 
estimate  was  not  based  on  a  rigorous  analysis  of  information  technology 
requirements  and  related  project  funding  needs.  Second,  an  estimated 
$600  million  in  Consular  Affairs’  information  technology  costs  were  not 
included  in  the  estimate.  Third,  some  of  the  requirements  and  associated 
costs  included  in  the  original  estimate  have  changed.  Finally,  State’s 
original  budget  estimate  and  related  planning  documents  do  not  identify  or 
quantify  potential  cost  savings  opportunities  associated  with  its  ongoing 
information  technology  support  and  irm  modernization  activities. 
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Key  Components  of 
State’s  IT  Planning 
and  Investment 
Process  Remain  to  Be 
Implemented 


Although  State  appointed  a  Chief  Information  Officer  and  established  an 
irm  Program  Board,  its  other  two  governing  boards — the  irm  Technical 
Review  Board  and  irm  Configuration  Control  Board — are  not  fully 
functioning.  In  addition,  while  State  does  have  an  active  irm  Program 
Board,  this  board  is  not  yet  functioning  as  intended  by  the  Clinger-Cohen 
Act  and  related  omb  guidance.  Moreover,  State  has  not  put  in  place  a 
Department-approved  information  technology  architecture,  a  key  output 
referred  to  in  its  conceptual  framework. 


IRM  Management 
Oversight  Boards  Not 
Adequately  Implemented 


According  to  State’s  conceptual  framework,  the  irm  Program  Board  has 
primary  responsibility  for  the  project  management  and  coordination 
process,  which  focuses  on  approving  and  monitoring  projects,  devising 
acquisition  plans,  and  periodically  assessing  State’s  total  it  portfolio.  This 
portfolio  includes  existing  projects,  pending  projects,  and  ongoing  support 
activities.  The  board,  consisting  of  senior-level  managers,  was  established 
in  1995. 


The  irm  Program  Board  has  not  yet  adopted  a  “portfolio-based”  approach 
to  managing  the  Department’s  it  resources.  This  approach  requires 
adopting  specific  evaluation  criteria  for  comparing  and  prioritizing 
alternate  investment  options  as  called  for  by  the  Clinger-Cohen  Act  and 
related  omb  guidance.  According  to  senior  officials  familiar  with  the 
operations  of  the  irm  Program  Board,  the  board  has  not  yet  systematically 
prioritized  State’s  tactical  plan  projects  or  reviewed  the  overall  mix  of 
funded  projects,  proposed  projects,  and  ongoing  support  expenses. 
Although  State  officials  noted  that  projects  that  clearly  relate  to  the  Year 
2000  issue  are  afforded  top  priority,  they  agreed  that  ultimately  all  existing 
and  proposed  projects  will  have  to  receive  a  carefully  considered  priority 
ranking. 

Until  recently,  the  irm  Program  Board  had  not  mandated  a  standard 
approach  to  developing  project  papers  or  required  the  inclusion  of  certain 
analytical  tools  such  as  cost-benefit  analyses;  retum-on-investments 
calculations;  alternatives  analyses,  including  the  potential  use  of 
outsourcing;  risk  assessments;  and  consideration  of  the  need  for  business 
process  reengineering.  To  address  these  concerns,  State’s  Chief 
Information  Officer  released  an  August  1998  memorandum  detailing  the 
Department’s  new  requirements  regarding  a  standardized  format  for 
project  proposals.  These  requirements  include  a  list  of  expected  analyses 
that  cover  the  areas  outlined  above.  This  is  a  positive  first  step.  However, 
the  quality  and  rigor  of  analyses  prepared  in  response  to  these 
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requirements  will  ultimately  determine  their  utility  to  the  Department  and 
the  it  planning  and  investment  process. 

The  irm  Technical  Review  Board  has  primary  responsibility  for  the  it 
architecture  management  process.  This  process  focuses  on  developing  key 
planning  documents  such  as  the  information  technology  architecture, 
security  and  technical  standards,  and  a  cost  model  to  chart  long-term 
funding  needs  and  trends.  The  irm  Technical  Review  Board  held  an 
organizing  meeting  in  February  1998  and  as  of  August  1998  had  not  held  a 
subsequent  meeting.  The  absence  of  a  functioning  irm  Technical  Review 
Board  has  hampered  State’s  ability  to  prepare  adequate  irm  planning 
documents,  such  as  an  information  technology  architecture,  and  reduced 
the  level  of  technical  scrutiny  project  proposals  receive. 

According  to  State’s  conceptual  framework,  the  irm  Configuration  Control 
Board  has  primary  responsibility  for  maintaining  an  inventory  of  agency 
information  resources,  monitoring  all  proposed  hardware  and  software 
proposals  for  compatibility  with  State’s  existing  systems,  and  ensuring  that 
all  proposed  changes  conform  to  the  Department’s  information  technology 
architecture.  Although  State  has  established  a  number  of  project-specific 
control  boards  whose  activities  should  be  coordinated  by  the  overall 
board,  the  irm  Configuration  Control  Board  has  never  been  formally 
constituted.  The  absence  of  the  board  increases  the  risks  that  State’s  new 
systems  will  have  compatibility  problems  due  to  the  implementation  of 
conflicting  technical  standards. 


State  Lacks  an  Integrated 
Information  Technology 
Architecture 


State  has  not  implemented  an  information  technology  architecture  as 
required  by  federal  legislation  and  related  omb  guidance.  As  computer 
systems  have  become  larger  and  more  complex  over  the  last  decade,  the 
importance  of,  and  reliance  on,  information  systems  architectures  has 
grown  steadily.  These  comprehensive  “blueprints”  systematically  detail  the 
full  breadth  and  depth  of  an  organization’s  mission  and  methods  of 
operation  in  (1)  logical  terms,  such  as  defining  business  functions  and 
providing  high-level  descriptions  of  information  systems  and  their 
interrelationship  and  (2)  technical  terms,  such  as  specifying  hardware, 
software,  data  communications,  security,  and  performance  characteristics. 
Without  an  architecture  to  guide  and  structure  a  modernization  program, 
there  is  no  systematic  way  to  prevent  either  inconsistent  system  design 
and  development  decisions  or  the  resulting  suboptimal  performance  and 
added  cost  associated  with  incompatible  systems. 
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The  Congress  and  omb  have  recognized  the  importance  of  agency 
information  systems  architectures.  The  Clinger-Cohen  Act,  for  example, 
requires  Chief  Information  Officers  to  develop,  maintain,  and  facilitate  the 
implementation  of  an  integrated  information  technology  architecture.  In 
addition,  omb  has  issued  guidance  that,  among  other  things,  requires 
agencies’  information  systems  investments  to  be  consistent  with  such 
architectures,  omb  has  also  issued  guidance  on  the  development  and 
implementation  of  agency  information  technology  architectures.8 

State  began  developing  an  information  technology  architecture  in  1996  and 
prepared  its  most  recent  draft  in  May  1996.  State’s  first  tactical  plan  called 
for  the  Department  to  have  a  key  component  of  its  information  technology 
architecture  in  place  and  validated  by  the  end  of  fiscal  year  1997. 

However,  almost  a  year  later,  the  documents  describing  the  architecture 
are  incomplete  and  have  not  been  endorsed  by  management  or  validated 
by  affected  offices  and  bureaus  across  the  Department. 


Implementation  of  the  IT 
Framework  Has  Not  Been 
a  Top  Priority 


The  Department  has  not  made  its  it  planning  and  investment  framework  a 
top  priority.  Evidence  to  support  this  view  includes  the  fact  that  State  did 
not  respond  to  omb’s  request  to  all  federal  agencies  to  report  by  May  1, 
1997,  on  progress  in  implementing  the  it  planning  and  investment 
processes  required  by  the  Clinger-Cohen  Act.  Of  the  28  executive  agencies 
identified  in  omb’s  memorandum,  State  was  the  only  agency  that  did  not 
respond  to  omb’s  request.  Also,  we  noted  that  a  senior  manager  with  lead 
responsibility  for  implementing  State’s  modernization  program  was  not 
aware  that  the  Department  had  prepared  a  draft  information  technology 
architecture  until  we  brought  it  to  his  attention. 


State  officials  attributed  delays  in  implementing  the  framework  to  a 
number  of  additional  factors,  including  senior  management  turnover, 
internal  reorganizations,  competing  priorities  such  as  the  Year  2000  and 
computer  security  issues,  staffing  shortages,  and  a  general  lack  of  vision 
regarding  the  Department’s  technical  direction  and  operational 
requirements.  Specifically,  State  officials  noted: 

•  Since  March  1996,  State  has  had  two  Under  Secretaries  for  Management, 
one  Acting  Chief  Information  Officer,  and  two  Chief  Information  Officers. 
The  most  recent  Chief  Information  Officer  was  appointed  in  May  1998.  In 
addition,  a  major  reorganization  of  the  Office  of  Information  Management 


Ending  Information  Systems  Investments,  OMB  Memorandum  M-97-02  (Washington,  D.C.:  OMB, 
Oct.  25, 1996)  and  Information  Technology  Architectures,  OMB  Memorandum  M-97-16  (Washington, 
D.C.:  OMB,  June  18,  1997). 
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occurred  in  early  1997,  and  a  second  major  reorganization  took  place  in 
March  1998  when  the  Office  of  Information  Management  was  placed  under 
the  Chief  Information  Officer,  thus  eliminating  a  long-standing  division 
between  policy  development  and  operations. 

•  Year  2000  and  computer  security  concerns  have  largely  consumed  the 
Department’s  resources  and  attention. 

•  Chronic  staffing  shortages  have  contributed  to  implementation  delays,  for 
example,  State’s  it  architecture  function  was  supposed  to  be  supported  by 
eight  full-time  staff  members;  however,  until  recently,  only  one  full-time 
employee  was  dedicated  to  this  function. 

•  The  Department  lacks  a  clear  sense  of  technical  direction  and  operational 
requirements.  The  absence  of  a  clear  and  reasonable  technical  direction, 
that  is  widely  articulated  and  agreed  to  by  senior  Department  officials,  is 
hampering  State’s  ability  to  properly  plan  its  it  investments  and  evaluate 
its  it  projects. 

State’s  Chief  Information  Officer  recently  told  us  that  he  is  committed  to 
implementing  the  Department’s  it  planning  and  investment  framework  and 
has  taken  steps  to  ensure  that  this  occurs.  For  example,  the  Chief 
Information  Officer  has  drafted  an  irm  vision  statement  for  the  Department 
and  has  called  for  the  irm  Technical  Review  Board  to  hold  its  first 
operational  meeting  this  September. 


Cost  Estimate  in  the 
Strategic  Plan  Is 
Speculative 


State’s  projected  5-year  irm  costs  of  $2.7  billion  are  speculative  for  a 
number  of  reasons.  First,  the  estimate  is  not  based  on  a  rigorous  analysis 
of  project  requirements  as  anticipated  in  State’s  conceptual  it  planning 
and  investment  framework.  Rather,  the  cost  estimate  in  State’s  strategic 
plan  was  largely  developed  by  the  Office  of  the  Chief  Information  Officer 
on  the  basis  of  certain  operating  assumptions,  which  were  developed  in 
the  absence  of  a  fully  functioning  it  planning  and  investment  process  that 
should  have  included  an  independent  assessment  of  these  assumptions 
and  cost  data  by  a  technical  review  group  as  called  for  in  State’s 
framework. 

In  addition  to  this  basic  shortcoming,  State’s  estimate  did  not  include 
about  $600  million  in  Consular  Affairs’  related  rr  costs.  For  fiscal 
year  1998,  Consular  Affairs  has  been  allocated  a  total  of  $139  million  for 
rr-related  activities,  including  its  visa  processing  and  name  check  systems 
that  are  installed  at  posts  around  the  world.  Consular  Affairs’  costs  would 
have  added  approximately  $600  million  to  State’s  original  $2.7  billion 
estimate.  State  officials  told  us  that  these  costs  were  left  out  of  the 
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estimate  because  they  assumed  that  the  costs  would  be  offset  by  expected 
revenues  from  machine-readable  visa  fees.  However,  State’s  conceptual 
framework  suggests  that  all  costs  should  be  included  in  the  Department’s 
long-term  rr  funding  projections. 

After  State  released  its  irm  cost  estimate  in  October  1996,  the  Department 
determined  that  its  requirements  and  cost  estimates  for  some  key  items 
will  have  to  be  revised.  Five  key  requirements  in  State’s  5-year  funding 
estimate  that  will  likely  need  updating  are  (1)  bandwidth,9  (2)  classified 
local  area  networks  overseas,  (3)  a  change  in  State’s  messaging  platform 
plans,  (4)  capital  replacement  needs,  and  (5)  anticipated  changes  to  State’s 
communication  networks.  In  addition,  the  potential  adoption  of  a  new 
worldwide  communication  system  could  have  cost  implications  for  State. 
The  following  discussion  provides  data  on  the  magnitude  of  these  new 
requirements  and,  where  available,  the  potential  cost  implications. 

•  State’s  original  estimate  assumed  that  $393  million  would  be  needed  to 
meet  projected  bandwidth  requirements  over  the  5-year  planning  period. 
According  to  State  documents,  this  estimate  was  largely  an  “educated  best 
guess.”  State  subsequently  launched  a  separate  tactical  plan  project 
designed  to  more  accurately  gauge,  among  other  items,  the  Department’s 
long-term  bandwidth  requirements.  Preliminary  survey  results  from  this 
project  for  fiscal  year  2000  suggest  the  Department  needs  to  update  its 
projected  bandwidth  requirements. 

•  State’s  original  cost  estimate  did  not  specifically  identify  the  cost  or 
number  of  classified  local  area  networks  required  at  overseas  posts. 
However,  State’s  current  tactical  plan  has  identified  the  potential  need  for 
200  classified  local  area  networks  overseas  (which  is  double  the  current 
number)  at  a  total  projected  cost  of  $167  million. 

•  One  of  the  core  assumptions  in  State’s  cost  estimate  was  that  State  would 
implement  a  new  messaging  system  based  on  the  Defense  Messaging 
System  at  an  estimated  cost  of  $127  million.  The  Defense  Messaging 
System  is  designed  to  handle  both  classified  and  unclassified  messaging 
needs.  However,  State  has  deferred  its  implementation  of  the  system 
pending  full  adoption  of  the  system  by  the  Department  of  Defense.  State’s 
irm  tactical  plan  estimates  that  the  Defense  Messaging  System  may  not 
become  fully  operational  until  2005  and  estimates  that  its  interim 
messaging  system  will  cost  $37.2  million  through  fiscal  year  2004. 

•  State’s  cost  estimate  does  not  include  all  of  the  Department’s  latest  it 
equipment  and  software  replacement  requirements  as  defined  in  the 


9“Bandwidth”  is  a  measure  of  the  amount  of  information  that  can  be  carried  over  a  communication  line 
at  any  given  moment. 
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February  1998  tactical  plan.  A  formal  replacement  schedule  and  related 
budget  estimates  will  need  to  be  developed  to  include  such  items  as 
network  servers,  routers,  hubs,  gateways,  printers,  and  operating  system 
software.  These  costs  could  amount  to  millions  of  dollars  annually. 

•  State  is  currently  considering  a  number  of  options  to  streamline  the 

operations  of  the  three  separate  communication  networks  described  in  the 
cost  model.  These  changes  will  have  cost  ramifications  not  anticipated  in 
State’s  original  cost  estimate. 

In  addition,  the  Diplomatic  Telecommunications  Service  Program  Office, 
which  provides  overseas  telecommunications  services  to  State  and  46 
other  federal  agencies,  is  currently  testing  a  new  communication  system 
known  as  the  Black  Router  Network.  Full  implementation  costs  for  this 
network  have  not  yet  been  identified  but  will  run  in  the  millions.  If  it  is 
adopted,  State  would  have  to  pay  a  significant  portion  of  these  costs. 


Cost  Savings  and 
Efficiencies  From 
Modernization  Not 
Identified 


State  has  not  identified  or  quantified  potential  cost  savings  or  efficiencies 
from  its  modernization  program.  State’s  irm  strategic  plan  lists  the 
achievement  of  greater  economies  in  it  resource  management  as  a  major 
goal.  However,  no  clearly  identified  and  quantified  cost  savings 
opportunities  are  discussed  in  its  cost  estimate  or  plans.  In  addition,  State 
has  not  attempted  to  benchmark  the  performance  of  its  rr  operations, 
including  the  cost-effectiveness  of  its  operations,  against  comparable 
public  and  private  sector  organizations  as  called  for  by  the  Clinger-Cohen 
Act. 

State  officials  acknowledge  that  there  are  opportunities  to  reduce  costs 
and  achieve  efficiencies  in  rr  operations  through  the  modernization  effort. 
State  officials  cited  consolidation  of  local  area  network  servers, 
mainframe  centers,  network  operating  centers,  and  help  desks;  remote 
system  management;  and  the  closing  of  communication  centers  as 
prospects  for  achieving  potential  cost  savings  or  instituting  efficient 
operations.  However,  in  these  and  other  cases,  State  has  not  developed 
specific  cost-saving  strategies  or  estimates.  For  example,  the  potential  for 
closing  communication  centers  overseas  in  response  to  the  introduction  of 
desktop  cable  delivery  systems  has  long  been  debated  as  a  potential 
cost-cutting  measure  in  State.10  However,  these  discussions  have  never 
progressed  to  the  stage  where  actual  strategies  and  expected  results  have 
been  laid  out.  The  practical  impact  of  implementing  such  a  reform  was 


'"State’s  overseas  communication  centers  are  staffed  with  an  estimated  530  employees.  According  to  a 
State  official,  these  employees  generally  have  additional  duties,  such  as  assisting  with  mail  and  pouch 
activities,  which  are  not  connected  with  the  communication  center’s  operations. 
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Conclusions  and 
Recommendations 


described  by  Canadian  Foreign  Ministry  officials  we  spoke  with  who 
explained  that  their  adoption  of  a  modem  messaging  system  led  to  the 
closure  of  all  overseas  communication  centers  and  the  termination, 
retirement,  or  reassignment  of  160  communication  workers. 

State  has  generally  not  benchmarked  the  cost-effectiveness  of  its 
operations  against  comparable  public  and  private  sector  organizations  as 
suggested  by  the  Clinger-Cohen  Act.  This  type  of  analysis  is  referred  to  as 
“metrics  benchmarking”  and  entails  the  use  of  quantitative  measures  such 
as  reference  points  for  comparison  against  prior  experience,  industry 
norms,  or  best-in-class  organizations.  Metrics  benchmarking  can  range 
from  broad  comparisons  using  such  measures  as  the  percent  of  total 
operating  costs  devoted  to  it  activities  to  more  finely  drawn  comparisons, 
such  as  the  average  cost  to  respond  to  a  help  desk  call.  Once  specific  cost 
comparisons  are  made  and  problem  areas  are  identified,  best  practices 
benchmarking  can  be  used  to  identify  the  practices  and  techniques 
employed  by  top  organizations  to  realize  cost  savings  or  to  operate  more 
efficiently  in  these  target  areas. 


State  has  launched  an  ambitious  modernization  program  in  support  of  its 
irm  strategic  plan.  Under  its  current  approach,  State’s  modernization  effort 
may  not  achieve  desired  goals  within  reasonable  costs  and  timeframes.  To 
date,  the  Department  has  not  made  the  full  implementation  of  its  it 
planning  and  investment  framework  a  top  priority  and  significant  portions 
of  the  framework  remain  to  be  implemented.  Absent  a  fully  implemented 
framework  and  the  adoption  of  the  best  practices  included  in  recent 
federal  legislation  and  related  guidance  from  omb  and  gao,  State’s  large  rr 
modernization  program  is  at  risk.  In  addition,  State’s  has  failed  to 
adequately  identify  the  current  scope  and  costs  of  its  it  operations  over  a 
5-year  period.  Such  projections  should  include  explicit  consideration  of 
expected  cost  savings  from  streamlined  operations,  the  deployment  of 
advanced  technology,  and  the  utilization  of  more  efficient  work  processes 
and  methods. 

We  recommend  that  the  Secretary  of  State  make  the  development  of  a 
fully  implemented  it  planning  and  investment  process  a  top  priority.  The 
Secretary’s  implementation  strategy  should  include 

•  establishing  a  fully  functioning  irm  Technical  Review  Board  and  irm 
Configuration  Control  Board, 
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•  establishing  a  validated  information  technology  architecture  to  help  guide 
the  Department’s  irm  modernization  and  ongoing  it  support  decisions, 

•  revising  (once  the  boards  and  architecture  are  in  place)  the  strategic  and 
tactical  plans  and  5-year  cost  estimate  and  identifying  potential  cost 
savings  or  efficiencies  expected  from  the  modernization  effort,  and 

•  establishing  specific  milestones  for  completing  the  full  implementation  of 
the  it  planning  and  investment  process,  and  a  mechanism  to  measure 
progress  against  these  milestones. 


Agency  Comments 
and  Our  Evaluation 


In  written  comments  on  a  draft  of  this  report,  State  concurred  with  the 
overall  thrust  of  our  report  and  noted  that  several  steps  had  recently  been 
initiated  to  implement  many  of  our  recommendations.  State  noted  that 
they  are  (1)  reconstituting  and  reconvening  the  irm  Technical  Review 
Board;  (2)  ordering  the  formation  of  a  Departmentwide  Configuration 
Control  Board;  (3)  drafting  an  rr  vision  paper  that  will  serve  as  the 
foundation  for,  among  other  key  planning  documents,  an  agency-validated 
information  technology  architecture;  and  (4)  planning  to  release  a  revised 
long-term  rr  funding  estimate  that  will  include  actual  and  potential  cost 
savings  resulting  from  State’s  modernization  efforts.  We  believe  these 
steps  are  positive  indicators  of  the  Department’s  intentions  to  fully 
implement  its  rr  planning  and  investment  framework. 

State  commented  that  our  report  did  not  sufficiently  describe  State’s  it 
modernization  initiatives  and  accomplishments.  It  noted  that  its  it 
planning  process  has  been  improved  and  progress  has  been  made  in 
modernizing  its  infrastructure.  State  highlighted  two  projects  that  it 
considers  to  be  successful — its  efforts  to  modernize  its  unclassified 
computer  and  communication  systems  and  its  consular  affairs  systems. 

We  recognize  that  State  has  implemented  several  modernization  projects; 
in  fact,  our  report  specifically  states  that  the  Department  has  a  number  of 
key  modernization  projects  underway.  However,  as  our  report  notes,  we 
did  not  evaluate  the  progress  or  effectiveness  of  individual  projects. 

State  also  noted  that  our  report  cites  only  “one  example”  of  a  failed 
modernization  program — its  efforts  to  modernize  its  financial  management 
system — as  evidence  that  State  has  experienced  difficulties  in  achieving  its 
short-  and  long-term  modernization  goals.  We  cite  this  example  to 
illustrate  the  difficulties  and  risks  associated  with  implementing  a 
large-scale,  complex  irm  project  in  the  absence  of  a  rigorous  planning  and 
investment  framework.  We  believe  that  State’s  difficulties  in  implementing 
a  key  modernization  program  such  as  financial  management  are  significant 
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and  point  to  the  need  for  full  implementation  of  State’s  rr  planning  and 
investment  framework. 

Our  report  objectives,  scope,  and  methdology  are  described  in  appendix  I, 
and  the  Department  of  State’s  written  comments  are  reprinted  in  their 
entirety  in  appendix  II. 


We  are  providing  copies  of  this  report  to  the  Secretary  of  State,  the 
Director  of  omb,  and  to  other  interested  congressional  committees.  Copies 
will  also  be  sent  to  others  upon  request. 

Please  contact  me  on  (202)  512-4128  if  you  or  your  staff  have  any 
questions  concerning  this  report.  Other  contributors  to  this  report  are 
listed  in  appendix  III. 


Benjamin  F.  Nelson,  Director 
International  Relations  and  Trade  Issues 
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Objectives,  Scope,  and  Methodology 


To  provide  information  and  analysis  on  the  progress  made  by  State  in 
implementing  key  information  technology  (it)  management  processes 
mandated  by  recent  federal  legislation  and  related  guidance,  we  compared 
State’s  it  management  framework  to  criteria  described  in  the  Office  of 
Management  and  Budget’s  (omb)  recently  issued  Capital  Programming 
Guide1  and  our  guide  for  assessing  it  investment  decisions.2  These 
documents  outline  a  disciplined  approach  to  managing  it  resources  and 
embody  the  best  practices  incorporated  in  several  recent  pieces  of  federal 
legislation,  including  the  1995  Paperwork  Reduction  Act3  and  the  1996 
Clinger-Cohen  Act.4  We  met  with  State  officials  to  determine  their 
interpretation  and  implementation  of  these  various  legislated 
requirements.  We  focused  on  State’s  overall  it  planning  and  investment 
management  process  and  how  policy  and  tactical-level  funding  decisions 
are  made.  We  did  not  review  individual  it  projects  for  adherence  with 
specific  best  practices  or  whether  these  projects  have  been  satisfactorily 
managed. 

To  provide  information  and  analysis  on  the  extent  to  which  State  has 
developed  a  sound  5-year  funding  estimate,  we  reviewed  the  October  1996 
cost  model  prepared  by  State  to  justify  its  $2.7-billion  cost  projection  as 
outlined  in  its  1997  strategic  plan  for  fiscal  years  1997-2001.  We  spoke  with 
State  Department  officials  responsible  for  developing  this  estimate  and 
reviewed  the  methodology  used  to  compile  the  data  in  the  cost  model.  We 
also  obtained  and  analyzed  available  cost  data  and  funding  analyses 
prepared  after  the  release  of  the  cost  model  in  October  1996  to  determine 
what  impact  they  might  have  on  long-term  cost  trends  and  planning 
assumptions.  Where  possible,  we  attempted  to  quantify  the  potential 
impact  of  major  planning  changes.  For  example,  we  sought  to  identify  the 
dollar  cost  associated  with  State’s  revised  communication  bandwidth 
requirements  needed  to  support  its  modernized  information  systems. 
Finally,  we  reviewed  the  latest  version  of  the  information  resource 
management  (irm)  tactical  plan,  which  includes  funding  projections  for 
individual  modernization  projects,  to  determine  if  baseline  funding 
estimates  for  certain  cost  model  items  had  been  significantly  revised. 


Capital  Programming  Guide  (Washington,  D.C.:  OMB,  July  1997). 

2Assessing  Risks  and  Returns:  A  Guide  for  Evaluating  Federal  Agencies*  IT  Investment 
Decision-making  (GAO/AIMD-IO.1.13,  Feb.  1997). 

3Public  Law  104-13, 109  Stat.  163. 

4Public  Law  104-106,  110  Stat.  679. 
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To  analyze  whether  State  had  identified  and  implemented  potential 
cost-cutting  opportunities,  we  reviewed  State’s  1997  irm  strategic  plan, 
each  of  the  summary  project  statements  included  in  the  erm  tactical  plan, 
and  tactical  plan  project  papers.  We  analyzed  each  of  these  documents  to 
determine  if  specific  cost-cutting  measures  were  discussed  and  to  what 
extent  attempts  were  made  to  quantify  any  expected  cost  savings. 

We  met  with  a  broad  range  of  State  officials,  a  former  Chief  Information 
Officer,  a  former  Acting  Chief  Information  Officer,  the  Deputy  Assistant 
Secretary  for  Information  Management,  tactical  plan  project  managers, 
technical  personnel,  bureau  it  representatives,  and  representatives  from 
State’s  Office  of  Inspector  General.  We  also  met  with  it  professionals  from 
the  U.S.  Agency  for  International  Development,  the  U.S.  Information 
Agency,  and  the  Diplomatic  Telecommunications  Service  Program  Office, 
and  with  Foreign  Ministry  representatives  from  Australia,  Canada,  and 
New  Zealand.  To  obtain  additional  outside  views  on  State’s  it 
modernization  program,  we  met  with  officials  from  the  Central 
Intelligence  Agency  and  omb.  We  also  met  with  government  contractors 
from  Lockheed  Martin  to  discuss  the  Defense  Messaging  System  that  State 
had  originally  proposed  to  implement.  We  also  met  with  Mobil  Oil 
Corporation’s  Chief  Information  Officer  to  discuss  Mobil’s  recent  irm 
modernization  effort,  which  has  been  highlighted  in  rr  literature  as  a 
“model”  reform  effort. 

We  reviewed  a  wide  number  of  prior  reports  and  studies  that  have 
examined  State’s  irm  operations,  including  our  December  1994  report5  on 
State’s  information  management  practices,  our  August  1998  report6  on 
State’s  Year  2000  remediation  efforts,  and  our  June  and  July  1998  reports 
on  the  status  of  State’s  Results  Act  planning  efforts.  7 


department  of  State:  Strategic  Approach  Needed  to  Better  Support  Agency  Mission  and  Business 
Needs  (GAO/AIMD-95-20,  Dec.  22, 1994). 

6On  January  1, 2000,  computer  systems  that  are  not  Year  2000  compliant  will  malfunction  or  produce 
inaccurate  information  because  the  year  2000  will  be  indistinguishable  from  the  year  1900.  This 
problem  is  rooted  in  the  fact  that  many  computer  systems  use  only  two  digits  to  designate  the  year.  We 
recently  reported  on  State’s  progress  in  addressing  Year  2000  issues.  See  Year  2000  Computing  Crisis: 
State  Department  Needs  to  Make  Fundamental  Improvements  to  Its  Year  2000  Program 
(GAO/AIMD-98-I62,  Aug.  28, 1998). 

7The  Government  Performance  and  Results  Act  of  1993  (P.L.  103-62, 107  Stat.  285),  commonly  referred 
to  as  the  Results  Act,  requires  that  all  federal  agencies  set  goals,  measure  performance,  and  report  on 
their  accomplishments.  As  such,  an  agency’s  IT  investments  should  directly  support  the 
accomplishment  of  these  goals,  and  agency  Results  Act  planning  documents  should  clearly  establish 
this  linkage.  See  The  Results  Act:  Observations  on  the  Department  of  State’s  May  1997  Draft  Strategic 
Plan  (GAO/NSIAD-97-198R,  July  18, 1997)  and  The  Results  Act:  Observations  on  the  Department  of 
State’s  Fiscal  Year  1999  Annual  Performance  Plan  (GAO/NSIAD-98-210R,  June  17, 1998). 
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We  performed  our  work  at  State’s  headquarters  in  Washington,  D.C.,  and 
visited  Ottawa,  Canada,  to  meet  with  it  officials  from  the  Canadian 
Foreign  Ministry  to  discuss  their  ongoing  irm  modernization  program  and 
to  tour  the  U.S.  embassy’s  rr  operations  in  Ottawa. 

We  conducted  our  review  between  April  1997  and  May  1998  in  accordance 
with  generally  accepted  government  auditing  standards. 
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Comments  From  the  Department  of  State 


United  States  Department  of  State 
Chief  Financial  Officer 
Washington,  D.C.  20520-7427 


September  16,  1998 


Dear  Mr.  Hinton: 

We  appreciate  the  opportunity  to  review  your  draft 
report,  "DEPARTMENT  OF  STATE  IRM:  Modernization 
Program  at  Risk  Absent  Full  Implementation  of  Key  Best 
Practices,1'  GAO  Job  Code  711268. 

Enclosed  are  the  Department's  comments  for 
incorporation  in  the  report.  If  you  have  any 
questions  concerning  this  response,  please  contact 
Mr.  Donald  C.  Hunter,  Deputy  CIO,  Architecture  and 
Planning,  at  (202)  776-8977. 

Sincerely, 

Kathleen  J.  Charles,  Acting 


Enclosure: 

As  stated, 
cc: 

GAO/NSIAD  -  Ms.  Glod 

-  Mr.  ten  Kate 
STATE/IRM/AP  -  Mr.  Hunter 


Mr.  Henry  L.  Hinton,  Jr., 

Assistant  Comptroller  General, 

National  Security  and  International  Affairs, 
U.S.  General  Accounting  Office. 
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Department  of  State  Comments  on  the  GAO  Draft  Report, 

“DEPARTMENT  OF  STATE  IRM:  Modernization  Program  at  Risk  Absent  Full 
Implementation  of  Key  Best  Practices,” 
GAO/NSIAD-98-242,  GAO  Job  Code  711268 


The  State  Department  welcomes  this  General  Accounting  Office  report  and  its 
suggestions  on  how  we  can  improve  our  essential  Information  Resource  Management 
(IRM)  planning  and  modernization  initiatives.  The  audit  report  provides  a  useful 
summary  of  State’s  initial  efforts  to  modernize  the  vast  information  technology 
infrastructure  deployed  in  support  of  the  nation's  global  diplomatic  mission.  We  concur 
with  the  report's  overall  thrust  and.  in  fact,  are  well  underway  implementing  many  of  its 
recommendations. 

However,  we  believe  the  draft  does  not  sufficiently  describe  the  many  IT 
modernization  initiatives  and  accomplishments  the  Department  already  has  achieved. 

The  IT  planning  process  has  been  greatly  improved  and  we  have  made  major  progress  in 
modernizing  our  infrastructure.  We  believe  these  improvements,  which  are  described  in 
detail  below,  directly  affect  the  report’s  conclusions  and  should  be  included. 

Improved  IT  Planning  and  Management 

In  February  1 998,  Congress  approved  the  Department’s  proposal  to  realign  the 
majority  of  information  technology  and  resource  management  functions  of  the  former 
Office  of  Information  Management  from  the  Bureau  of  Administration  to  the  Office  of 
the  CIO.  This  action  has  consolidated  information  technology  programs  under  the 
leadership  of  one  centrally  managed  office,  and  thereby  enhanced  the  focus  and  control 
over  information  technology  issues. 

In  May  1998,  a  new  Chief  Information  Officer  (CIO),  with  over  20  years  of 
professional  experience  in  all  facets  of  IT,  arrived  and  took  immediate  steps  to  improve 
IT  planning  and  management  in  the  Department.  For  example,  he  elevated  the  Year 
2000,  IT  security  and  planning  and  Architecture  to  the  Deputy  CIO  level.  He  oversaw 
the  creation  of  an  IT  vision  paper  that  outlines  the  major  new  directions  that  our  strategic 
plan,  cost  model  and  architectures  must  move  after  the  year  2000.  He  enhanced  the  IRM 
investments  review  process,  reconstituted  and  reconvened  the  Technical  Review  Board, 
and  ordered  the  formation  of  a  Department-wide  Configuration  Control  Board.  He  also 
continued  a  formal  process  begun  earlier  in  the  year  to  review  all  major  bureau  IT 
projects  monthly.  During  these  reviews,  the  progress  of  each  project  is  monitored  and 
project  managers  report  anticipated  changes  to  established  milestones.  Senior  IRM 
Bureau  managers  also  conduct  bi-weekly  project  monitoring  meetings  to  ensure  that  all 
projects  receive  ongoing  individual  management  attention. 

In  addition  to  these  recent  accomplishments,  there  have  been  other  improvements 
under  way  for  some  time.  In  January  1997,  we  created  the  Department’s  first  IRM 
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Strategic  and  Performance  Plan  (as  mandated  by  the  Government  Performance  and 
Results  Act  of  1993)  and  the  first  IRM  Tactical  Plan.  These  plans,  along  with  the 
Department’s  overall  Strategic  Plan  and  Performance  Plan,  have  greatly  improved  the 
definition  of  State’s  business  requirements  and  the  integration  of  IT  planning  with  other 
administrative  and  substantive  planning.  The  Tactical  Plan  was  newly  created  to  enhance 
the  ability  of  the  Department  to  identify  and  coordinate  its  many  IT  initiatives  and 
effectively  fund  them.  OMB,  the  Congress,  and  GAO  itself  had  praised  this  document, 
and  its  format  is  being  copied  by  agencies  such  as  HUD.  The  Department  has  derived 
and  established  appropriate  IRM  priorities  by  using  these  documents  and  providing 
significant  focus  to  previously  uncoordinated  IT  initiatives. 

Integration  of  IRM  planning  with  other  planning  processes  in  the  Department  has 
also  been  and  continues  to  be  improved  by  the  establishment  of  a  new  IRM  Bureau  under 
the  direct  management  of  the  Department’s  permanent  CIO.  In  February  1998,  Congress 
approved  the  Department’s  proposal  to  realign  the  majority  of  information  technology 
and  resource  management  functions  of  the  former  Office  of  Information  Management 
from  the  Bureau  of  Administration  to  the  Office  of  the  CIO.  This  action  has  substantially 
consolidated  information  technology  programs  under  the  leadership  of  one  centrally 
managed  office,  and  thereby  enhanced  the  focus  and  control  over  information  technology 
issues. 

In  addition,  the  new  CIO  has  instituted  a  monthly  formal  review  process  for  all 
major.  During  these  reviews,  the  progress  of  each  project  is  monitored  and  project 
managers  report  anticipated  changes  to  established  milestones.  Senior  IRM  Bureau 
managers  also  conduct  bi-weekly  project  monitoring  meetings  to  ensure  that  all  projects 
receive  ongoing  management  attention. 

The  IRM  Bureau  has  already  prepared  an  IRM  Bureau  Performance  Plan  to 
support  the  diplomatic,  consular,  and  management  priorities  stipulated  in  the 
Department’s  Strategic  Plan.  The  IRM  Bureau’s  Performance  Plan  was  required  as  part 
of  the  Department- wide  performance  planning  effort.  Included  for  the  first  time  in  the 
current  effort  is  IRM  resource  data  reports  from  all  bureaus  and  overseas  posts.  While 
this  information  still  needs  to  be  validated,  it  will  provide  the  foundation  for  a  more 
comprehensive  accounting  of  State’s  total  IRM  investments. 

In  addition,  the  Department-wide  IRM  Tactical  Plan  has  now  been  adjusted  to 
reflect  the  priorities  and  emerging  strategies  being  developed  in  our  revised  IRM 
Strategic  and  Performance  Plan  and  enables  a  more  thorough  integration  of  the  IT 
planning,  budgeting  and  investment  evaluation  process.  This  initiative  is  aiding  the 
Department  in  its  efforts  to  implement  sections  5121  and  5123  of  the  Clinger-Cohen  Act, 
and  assure  maximum  value  for  the  IT  dollars  it  spends.  As  alluded  to  above,  under  the 
direction  of  the  Department’s  new  CIO,  the  Department  has  developed  a  detailed  IT 
vision  paper  for  fiscal  year’s  2001  -  2005,  which  is  now  being  reviewed  within  the 
Department  prior  to  being  made  public.  Once  approved,  the  vision  paper  will  serve  as 
the  foundation  for  a  new  IRM  Strategic  and  Performance  Plan  and  drive  the  development 
of  technical  architectures' as  called  for  in  section  5125  of  the  Clinger-Cohen  Act. 
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The  IRM  Program  Board,  chaired  by  the  Under  Secretary  for  Management, 
continues  to  review  all  major  new  and  on-going  IRM  projects.  The  IRM  Program  Board 
focuses  on  the  priorities  established  in  the  Department’s  Strategic  Plan  and  the  derivative 
IRM  Tactical  Plan  in  evaluating  projects  presented  to  it.  An  increasingly  rigorous 
process  is  being  implemented  to  assure  decisions  on  IT  investments  are  in  keeping  with 
federal  requirements.  For  example,  beginning  with  the  September  1998,  IRM  Program 
Board,  each  project  manager  is  required  to  describe  and  document  how  their  project 
meets  the  Department’s  IT  performance  goals  in  four  specific  areas.  Additionally, 
projects  must  incorporate  defined  performance  measures,  both  output  (efficiency)  and 
outcome  (effectiveness)  to  demonstrate  progress  and  the  benefits  to  be  derived  by  the 
initiative. 

The  Department  has  not  fully  implemented  the  three  inter-related  oversight  boards 
in  the  manner  it  originally  envisioned  as  described  in  its  1996  framework  documents. 

Yet,  since  its  inception  in  1997,  the  IRM  Program  Board  has  informally  carried  out  many 
of  the  roles  that  we  initially  anticipated  would  be  split  among  the  three  separate  boards. 
The  IRM  Program  Board  has,  for  instance,  systematically  considered  the  technical  merits 
of  nearly  all  its  programs  -  thus  partially  fulfilling  the  role  of  a  Technical  Review  Board. 
And  the  IRM  Program  Board  frequently  revisits  the  funding  decisions  on  previously 
approved  IT  initiatives  throughout  the  project’s  lifecycle  -  thus  acting  in  the  capacity  of  a 
Configuration  Control  Board. 

However,  to  better  define  and  separate  these  important  roles,  the  new  CIO  has 
recently  reinstituted  a  Technical  Review  Board  (TRB)  to  evaluate  all  major  IRM  projects 
for  technical  and  architectural  compliance  before  funding  consideration  by  the  IRM 
Program  Board.  The  first  TRB  convened  in  early  September  to  consider  projects  seeking 
FY  1999  IRM  central  fund  allocations.  As  currently  constituted,  the  TRB  members  are 
the  most  senior,  technically  qualified  managers  in  the  Department  and  represent  a  broad 
cross  section  of  bureaus  and  offices.  Several  additional  TRB  meetings  are  already  being 
scheduled  (another  one  is  scheduled  for  the  week  of  September  28,  1 998)  to  review  the 
draft  technical  architectures,  initial  IT  vision  paper,  and  other  key  IRM  initiatives  as  the 
TRB  procedures  continue  to  be  refined. 

Similarly,  the  Department  is  now  establishing  a  Configuration  Control  Board  to 
assure  that  projects,  once  funded,  remain  on  track  and  meet  their  projected  milestones 
while  supporting  the  Department’s  overall  technical  direction.  The  largest,  single 
modernization  program  in  the  Department,  A  Logical  Modernization  Approach  (ALMA) 
Project  has,  for  about  18  months,  successfully  operated  such  a  board,  which  has  met  on 
over  30  occasions  to  keep  the  project  on  track,  within  budget,  and  true  to  its  original 
goals.  The  new  CIO  is  expanding  this  proven  body  to  function  Department-wide 
beginning  in  early  FY  1999.  Once  implemented,  the  IRM  Configuration  Control  Board 
will  fulfill  sections  5113  and  5121  of  the  Clinger-Cohen  Act  and  provide  a  standard 
means  for  senior  managers  to  obtain  timely  information  regarding  the  progress  of  all 
major  IT  investments. 
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The  Department  has  also  included  IRM  workforce  planning  as  part  of  our  overall 
human  resource  planning  and  modernization  efforts.  The  IRM  Bureau  is  working  closely 
with  the  Department’s  Bureau  of  Personnel  and  the  Foreign  Service  Institute,  responsible 
for  State’s  education  and  training  programs  to  accomplish  this  initiative.  Joint  efforts 
underway  are  focused  on  identifying  the  current  knowledge,  skills  and  abilities  of  our  IT 
professionals,  forecasting  future  skills  and  workload  requirements,  and  developing  a  plan 
to  address  any  skills  shortfalls. 

Technology  Infrastructure  Successes 

While  much  work  remains,  the  Department  has  made  tremendous  progress  in 
modernizing  its  information  technology  infrastructure  over  the  last  several  years.  The 
report  cites  only  one  example  of  a  failed  modernization  effort  as  evidence  of  the  draft's 
conclusion  that  State  has  "experienced  difficulties  in  achieving  its  short-  and  long-term 
modernization  goals."  Yet,  die  GAO  report  ignored  the  highly  successful  $120  million 
ALMA  program  and  the  $140  million  Bureau  of  Consular  Affairs  global  modernization 
programs  in  making  such  a  negative  statement.  These  two  programs,  which  have  been 
underway  for  nearly  two  years,  are  the  foundation  of  the  Department’s  global  IT 
modernization.  We  recommend  striking  from  the  text  of  this  report  the  following 
statements: 

“For  example,  in  August  1994,  we  reported  that  State’s  attempt  to  modernize  its 
financial  management  systems  was  subject  to  a  high  risk  of  failure  because  the 
Department’s  management  and  planning  for  this  effort  had  been  inadequate. 
Subsequently,  in  1995  State  ended  this  effort  and  adopted  a  revised  approach  to 
modernizing  its  domestic  and  overseas  financial  system.” 

Our  position  for  excluding  this  text  is  based  on  the  age  of  the  reference  (over  4 
years  old)  and  the  relative  magnitude  of  this  effort  when  compared  to  other  efforts  cited 
in  this  response.  Additionally,  we  recommend  the  following  revisions  to  the  second 
statement  in  the  referenced  passage: 

“Subsequently  in  1 995,  State  adopted  a  revised  approach  to  modernizing  its 
domestic  and  overseas  financial  systems.” 

The  Department’s  flagship  modernization  effort,  ALMA,  has  been  highly 
successful.  Through  ALMA,  the  Department  is  deploying  a  fully  modernized 
unclassified  computer  and  communications  system  that  will,  when  complete,  support 
enhanced  office  automation,  modernized  bureau  and  Department-wide  corporate 
applications,  and  improved  access  to  information  age  technologies,  such  as  the  Internet, 
video  teleconferencing  and  geographic  information  systems  data.  ALMA  is  the  most 
complex  and  aggressive  IT  modernization  program  ever  attempted  by  State  and  is  on 
schedule  and  within  2  percent  of  budget.  Over  half  of  the  230  overseas  posts  scheduled 
to  receive  the  ALMA  infrastructure  by  the  end  of  FY  1999  are  complete.  The  conduct  of 
U.S.  foreign  policy  is  being  enhanced  by  ALMA  as  Department  officers  gain  access  to 
business  quality  e-mail  and  office  automation  tools.  ALMA  also  provides  the  underlying 
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infrastructure  for  other  Y2K  and  IT  modernization  projects..  In  accomplishing  ALMA, 
the  IRM  Bureau  is  working  with  the  Foreign  Service  Institute  for  training,  the  Diplomatic 
Telecommunication  Service  Program  Office  for  global  communications,  and  the 
Consular  Affairs  modernization  program,  which  is  also  on  schedule  and  within  budget  for 
its  modernization  efforts.  These  major  IT  initiatives  highlight  State's  dedication  to 
effective  project  management  principles.  The  ALMA  program  will  have  modernized  all 
overseas  posts  scheduled  for  updating  by  the  end  of  FY  1999. 

The  IT  modernization  program  sponsored  by  the  Bureau  of  Consular  Affairs  is 
progressing  on  target  as  well.  To  date,  75  percent  of  the  worldwide  non-immigrant  visa 
volume  is  now  handled  by  modernized  systems  and  we  are  on  track  to  complete  the  entire 
project  by  July  1999.  Additionally,  all  users  now  have  access  to  the  enhanced  CLASS 
namecheck  system,  which  allows  posts  to  transmit  and  receive  automated  information  on 
visa  and  passport  applicants  in  real-time,  24  hours  a  day,  at  every  Foreign  Service  post 
and  in  every  passport  agency.  The  total  effect  of  the  modernization  effort  undertaken  by 
the  Bureau  of  Consular  Affairs,  in  conjunction  with  the  IRM  Bureau  is  new  consular 
systems  that  enhance  U.S.  border  security  by  allowing  the  production  of  more  secure 
travel  documents  and  better  control  who  receives  these  documents. 

In  addition,  the  Department  has  achieved  significant  progress  implementing  a 
variety  of  other  information  technology  modernization  projects.  All  of  these  projects  are 
included  in  IRM’s  Strategic  and  Performance  Plan  and  further  State’s  overall 
modernization  interests.  At  the  same  time,  they  will  contribute  to  advancing  the  goals 
contained  in  the  preliminary  IT  vision  paper  now  being  circulated.  During  the  past  two 
years  State  has  accomplished  the  following: 

>  Acquired  new  mainframe  computers  for  its  two  mainframe  processing  sites, 
the  Main  State  Data  Processing  Center  and  the  Beltsville  Messaging  Center. 
These  upgrades  have  significantly  enhanced  the  Department’s  ability  to 
conduct  data-intensive  computing  applications  such  as  performing  security 
background  checks  on  the  names  and  potential  aliases  of  all  foreign  visa 
applicants  seeking  to  visit  the  United  States. 

>  Made  major  progress  in  deploying  a  high-speed  switched  data  network  to 
support  the  Department’s  headquarters.  This  project  will  ultimately  extend 
the  high-speed  network  to  all  locations  in  the  metropolitan  Washington  area, 
thereby  providing  America’s  diplomatic  headquarters  with  state-of-the-art 
communications  and  information  management  connectivity. 

>  Installed  new  telephone  systems  to  replace  obsolete  systems  at  39  U.S. 
embassies  and  consulates. 

>  Deployed  new  emergency  satellite  systems  to  regional  locations  throughout 
the  world  to  ensure  quick  response  in  crises.  These  systems  were  essential  to 
quickly  and  effectively  restoring  communications  to  the  embassies  recently 
bombed  in  East  Africa. 
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>  Made  certain  that  all  posts'  telegraphic  communications  processor  systems  are 
Year  2000  compliant,  thereby  ensuring  that  the  Department's  official 
diplomatic  communications  channels  will  work  reliably  at  the  turn  of  the 
century. 

>  Upgraded  the  Department’s  domestic  communications  center.  This  upgrade 
improved  the  center’s  capacity  to  act  as  the  hub  for  receipt,  authentication  and 
delivery  of  all  official  message  traffic  between  the  Department,  U.S. 
diplomatic  missions  and  other  U.S.  Government  locations  worldwide. 

>  Instituted  and  assured  the  on-going,  systematic  training  of  IRM  project 
managers  as  a  key  element  of  implementing  a  thorough  and  consistent  project 
management  approach  to  new  and  existing  IT  initiatives.  Over  250 
Department  managers  have  been  trained  in  the  Managing  State’s  Project 
methodology. 

Leveraging  Other  IT  Efforts 

The  new  CIO  has  effectively  addressed  some  of  the  key  IT  management  priorities 
that  have  been  the  focus  of  previous  GAO  audit  reports  in  the  last  several  months.  In 
aggressively  dealing  with  these  challenges,  such  as  the  Year  2000  problem  and  enhancing 
IT  security,  the  IRM  Bureau  is  now  poised  to  raise  the  priority  of  and  devote  the 
appropriate  FTE  needed  for  IT  architecture  and  planning.  It  is  true  that  by  aggressively 
addressing  Year  2000  vulnerabilities  and  IT  security,  full  implementation  of  State’s  IT 
planning  processes  and  architecture  development  have  been  delayed.  However,  the  focus 
on  Year  2000  has  resulted  in  a  Department-wide  configuration  management  process  for 
all  software  applications  and  allowed  all  of  the  Department’s  network  interdependencies 
to  be  fully  known  and  diagrammed.  These  efforts  will  benefit  the  development  of  IT 
architectures  and  significantly  assist  projects  meet  requirements  of  the  enterprisewide 
Configuration  Control  Board,  now  under  development. 

GAO’s  draft  makes  reference  to  the  lack  of  staff  assigned  to  architecture 
development  and  the  IT  planning  office.  This,  indeed,  has  been  a  challenge  over  the 
course  of  the  past  year.  For  the  past  three  to  four  years  the  entire  IRM  Bureau  was 
plagued  by  a  vacancy  rate  of  nearly  30  percent.  This  staff  shortage  has  hampered  many 
IT  initiatives  -  planning  and  architecture  among  them.  However,  the  new  CIO  has  made 
recruiting  a  top  priority  and  we  have  been  steadily  reducing  this  number.  The 
development  of  an  IT  architecture  has  now  been  accelerated.  The  new  CIO  has  named 
three  deputies  and  elevated  their  responsibilities  for  key  IT  management  areas.  The  Year 
2000  Project  Management  Office  is  now  directed  by  a  Deputy  CIO  and  the  responsibility 
for  IT  security  has  also  been  elevated  to  a  Deputy  CIO  position.  Increased  focus  is  now 
on  fully  implementing  a  robust  and  integrated  IT  planning  and  architecture  function. 
Earlier  in  1998,  the  divided  responsibility  for  architectures  was  resolved  by  appointing  a 
Deputy  CIO  charged  with  guiding  the  improvements  in  IT  planning  and  architecture  and 
a  new  IT  architecture  team  was  named. 
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Response  to  GAO  Recommendation 

The  various  actions  outlined  above  have  significantly  improved  the  IT  planning 
and  investment  processes  in  the  State  Department.  These  successful  programs  provide  a 
firm  foundation  for  our  continuing  efforts  to  strengthen  IRM  planning  and  develop  an 
enterprisewide  IT  architecture  as  required  by  the  Clinger-Cohen  Act  and  to  which  the 
Department  is  committed.  The  following  sections,  addressing  the  four  specific  elements 
of  the  recommendation  for  an  IT  planning  and  investment  implementation  strategy  in  the 
GAO  report,  detail  how  we  are  moving  to  build  upon  our  recent  related  accomplishments. 

Element  I:  Establish  a  fully  functioning  IRM  Technical  Review  Board  and  IRM 
Configuration  Control  Board. 

State  Department  Response:  The  Department  is  in  the  process  of  establishing  a  fully 
functioning  IRM  Technical  Review  Board  and  IRM  Configuration  Control  Board  as 
originally  envisioned  in  1997  and  as  recommended  by  the  Clinger-Cohen  Act.  The 
second  formal  meeting  of  the  IRM  Technical  Review  Board  was  held  on  September  9, 
1998  and  the  next  meeting  will  be  held  the  week  of  September  28, 1998.  While  this 
Board  is  just  becoming  functional  at  this  juncture,  we  have  established  this  Board  and  we 
are  moving  aggressively  to  strengthen  its  organization.  The  Department  also  has 
established  a  Configuration  Control  Board  associated  with  our  primary  modernization 
effort,  ALMA.  As  ALMA  is  setting  standards  and  deploying  the  basic  foundation  for  the 
vast  majority  of  the  Department  information  systems,  we  are  also  in  the  process  of 
expanding  this  ALMA  Configuration  Control  Board’s  authority  into  a  Department-wide 
Configuration  Control  Board.  This  effort  is  now  underway  and  we  expect  to  have  it  in 
place  by  January  31,1 999. 

Element  2:  Establish  a  validated  information  technology  architecture  to  help  guide  the 
Department’s  IRM  modernization  and  ongoing  IT  support  decisions. 

State  Department  Response:  The  Department  has  done  much  to  establish  a  consistent 
information  technology,  based  on  open  systems  standards.  In  the  ALMA  program,  for 
example,  the  Department  has  already  established  and  documented  an  IT  architecture  for 
its  global  infrastructure.  That  architecture  is  the  underlying  basis  for  all  the  ALMA 
standards,  is  detailed,  widely  available,  and  has  been  disseminated  by  cable  and  the 
Department's  Intranet.  The  ALMA  technology  architecture  established  the  Department's 
direction  towards  Internet  Protocol  (IP)  based  networks,  Windows  NT  operating  systems, 
and  many  other  standards.  State  Department's  preliminary  IT  vision  paper,  referenced  in 
the  GAO  report,  is  focused  on  Fiscal  Years  2001  -  2005  and.  once  approved,  will 
describe  how  new  IT  initiatives  and  priorities  will  aid  the  Department  to  move  in  new, 
business-centered  directions.  These  directions  will  be  more  fully  detailed  in  the 
Department’s  next  Strategic  Plan  and  supported  by  a  set  of  specific  IT  architectures  that 
will  help  govern  the  numerous  ongoing  and  emerging  IT  initiatives. 
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The  Department’s  current  draft  Tactical  Plan  (dated  July  1998)  specifies  concrete 
milestones  for  the  development  and  dissemination  of  detailed  architectures.  These 
information  architectures  will  include  technical  definitions  related  to  security,  network 
operations,  information  services,  applications,  and  data.  An  initial  architectures 
document  will  be  published  by  the  end  of  the  first  quarter  FY1999  and  the  remaining 
standards  will  be  completed  by  the  end  of  FYI 999.  The  Department  is  committed  to  and 
engaged  in  establishing  robust  and  comprehensive  IT  architectures.  However,  it  is 
important  to  note  that  IT  architectural  efforts  are,  by  their  nature,  always  in  progress  and 
must  be  adjusted  to  a  constantly  changing  information  technology  environment.  In  this 
regard  and  in  relationship  to  the  GAO  recommendation,  an  IT  architectural  effort  is  never 
entirely  “done,”  but  is  instead  an  evolving  process  that  guides  and  structures  IT 
initiatives. 

Element  3:  Revise  (once  the  boards  and  architecture  are  in  place)  the  strategic  and 
tactical  plans  and  5-year  cost  estimate  and  identifying  potential  cost  saving  or  efficiencies 
expected  from  the  modernization  effort. 

State  Department  Response:  The  Department  has  already  begun  to  revise  its  IT 
strategic  and  tactical  plans  to  better  reflect  the  business  requirements  and  resource 
constraints  stipulated  in  the  Department  of  State  Strategic  Plan  and  associated 
performance  planning  process,  as  mandated  by  the  Government  Performance  and  Results 
Act.  In  addition,  the  preliminary  IT  vision  paper  sets  a  new  technical  direction  for  the 
Department,  making  the  previous  IRM  Strategic  and  Performance  Plan,  and  associated 
cost  model,  no  longer  valid  as  a  future  vision  for  the  Department.  Once  the  IT  vision 
paper  is  finalized  and  a  new  IRM  Strategic  Plan  is  developed  in  the  coming  months,  State 
will  have  the  foundation  to  articulate  its  overriding  technical  framework  and  produce  a 
new,  more  accurate  and  viable  cost  model.  Senior  Department  officials  and  IRM 
managers  recognize  that  its  1997  Strategic  and  Performance  Plan  no  longer  portrays  the 
current  state  or  future  direction  State  will  take  in  this  rapidly  evolving  age  of  information 
technology.  In  FYI 999,  the  Department  will  publish  a  new  Strategic  Plan  that  will  be 
built  upon  a  defined  set  of  IT  architectures  and  underscored  by  fully  implemented 
planning  and  investment  boards  responsive  to  the  intent  of  the  Clinger-Cohen  Act.  For 
example,  the  1998  IRM  Tactical  Plan  includes  the  following  guiding  principle. 

“The  IRM  Bureau  is  exploring  the  operational  and  economic  feasibility  of 
developing  a  secure  large-scale  unclassified  information  network  to  link 
all  of  State  internally  via  an  Intranet;  and,  this  same  network  would  link 
the  Department  to  the  world  via  the  Internet  and  the  World-Wide  Web.  To 
handle  the  relatively  small  percentage  of  information  that  is  truly 
classified,  we  would  deploy  a  smaller  scale  classified  system.” 

This  modernization  approach  would  do  much  to  reduce  costs  and  enhance 
efficiencies  as  the  GAO  suggests,  and  the  Department  is  pursuing  this  and  other 
initiatives  in  order  to  identify  and  reduce  costs  and  increase  effectiveness  and 
efficiencies. 
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Element  4:  Establish  specific  milestones  for  completing  the  full  implementation  of  the  IT 
planning  and  investment  process,  and  a  mechanism  to  measure  progress  against  these 
milestones. 

State  Department  Response:  Under  the  new  CIO,  the  Department  has  initiated  a  process 
to  develop  a  new  IRM  Strategic  Plan  to  guide  IT  efforts  from  2000  -  2004.  To  date,  we 
have  developed  a  high-level  IT  vision  paper  that  highlights  five  broad  IT  goals  for  the 
new  millennium.  This  conceptual  paper  is  being  circulated  in  conjunction  with  briefings 
and  technology  demonstrations  to  build  consensus  for  a  new  strategic  vision.  We 
anticipate  this  new  strategic  vision  will  be  published  by  the  end  of  the  first  quarter 
FY1999.  The  new  vision  contains  specific  steps  for  developing  performance  metrics  to 
assess  the  success  of  the  Department’s  efforts  to  fully  implement  a  coherent  IT  planning 
and  investment  process.  And,  while  a  number  of  significant  improvements  have  already 
been  adopted  in  the  development  of  the  current  tactical  plans,  an  ongoing  process  of 
improvement  is  underway  to  better  incorporate  both  the  spirit  and  the  letter  of  GPRA. 
Each  iteration  of  the  tactical  plan  has  resulted  in  the  institution  of  better  means  to 
evaluate  the  progress  the  sponsoring  office  or  bureau  makes  in  achieving  its  IT 
milestones. 


In  closing,  we  fully  recognize  the  critical  importance  of  IT  to  the  support  of  U.S. 
diplomacy  and  the  effectiveness  of  the  State  Department  in  the  information  age.  While 
significant  results  have  been  achieved  in  modernizing  and  improving  our  IT,  there  is 
more  to  do.  We  continue  to  strengthen  our  IT  efforts  by  enhancing  IT  management 
oversight  and  investment  planning  at  the  State  Department.  We  understand  the  need  to 
specifically  address  the  Clinger-Cohen  Act  and  related  OMB  mandates  as  they  relate  to  a 
strong  IT  planning  and  investment  processes,  an  articulated  technology  architecture,  and 
a  comprehensive  strategic  technology  vision.  As  such,  the  CIO  has  directed  the  IRM 
Bureau  to  take  the  lead  in  prioritizing  these  requirements  and  has  set  as  a  goal  for  the 
Department  to  become  a  model  organization  operating  in  conformance  with  applicable 
federal  regulations  and  proactively  managing  a  results-based  IT  environment. 
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The  first  copy  of  each  GAO  report  and  testimony  is  free. 
Additional  copies  are  $2  each.  Orders  should  be  sent  to  the 
following  address,  accompanied  by  a  check  or  money  order 
made  out  to  the  Superintendent  of  Documents,  when 
necessary.  VISA  and  MasterCard  credit  cards  are  accepted,  also. 
Orders  for  100  or  more  copies  to  be  mailed  to  a  single  address 
are  discounted  25  percent. 

Orders  by  mail: 

U.S.  General  Accounting  Office 
P.O.  Box  37050 
Washington,  DC  20013 

or  visit: 

Room  1100 

700  4th  St.  NW  (corner  of  4th  and  G  Sts.  NW) 

U.S.  General  Accounting  Office 
Washington,  DC 

Orders  may  also  be  placed  by  calling  (202)  512-6000 

or  by  using  fax  number  (202)  512-6061,  or  TDD  (202)  512-2537. 

Each  day,  GAO  issues  a  list  of  newly  available  reports  and 
testimony.  To  receive  facsimile  copies  of  the  daily  list  or  any 
list  from  the  past  30  days,  please  call  (202)  512-6000  using  a 
touchtone  phone.  A  recorded  menu  will  provide  information  on 
how  to  obtain  these  lists. 

For  information  on  how  to  access  GAO  reports  on  the  INTERNET, 
send  an  e-mail  message  with  "info"  in  the  body  to: 

info@www.gao.gov 

or  visit  GAO’s  World  Wide  Web  Home  Page  at: 
http://www.gao.gov 
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